Re: [PATCH net v3] net: rds: fix uninitialized trans dereference in CM event handler

[sashiko-bot@kernel.org]

> From: Aohan Mei <henrymei@tencent.com>
> 
> rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA
> device is an InfiniBand CA (RDMA_NODE_IB_CA).  On any other device
> type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but
> the event switch dereferences it: unconditionally in the
> RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(),
> and (with a connection context) in the ROUTE_RESOLVED and
> ESTABLISHED cases.
> 
> An RDS listener on an iWARP device therefore crashes the kernel as
> soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO
> the wild load becomes a NULL dereference at offset 0xa0
> (&trans->cm_handle_connect) in the iw_cm_wq workqueue.
> 
> [ ... ]
> [achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of
>  bailing out for every event on a non-IB device, so that rdma_cm does
>  not destroy connection ids RDS still tracks; changelog adjusted]
> Assisted-by: Claude-Code:claude-fable-5
> Signed-off-by: Allison Henderson <achender@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928044507.335883-1-achender@kernel.org?part=1